Connect Secure at a glance
2 of the exploited vulnerabilities are known to be used by ransomware (CISA).
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 1 | 0 |
| Oct 2026 | 2 | 0 |
| Sep 2026 | 0 | 0 |
| Aug 2026 | 0 | 0 |
| Jul 2026 | 0 | 0 |
| Jun 2026 | 0 | 0 |
| May 2026 | 0 | 0 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 9 | 0 |
| Aug 2025 | 4 | 0 |
| Jul 2025 | 6 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 1 | 1 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 7 | 3 |
| Jan 2025 | 2 | 1 |
| Dec 2024 | 5 | 2 |
Most common weaknesses
Latest advisories
-
High max 8.6
Ivanti Connect Secure: Schwachstelle ermöglicht die Umgehung von Authentifizierung und Codeausführung
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Ivanti Connect Secure ausnutzen, um Sicherheitsvorkehrungen zu umgehen und um beliebigen Code auszuführen.
first Oct 13, 2026 -
Critical max 8.6
ZeroDay kwetsbaarheden verholpen in Ivanti Connect Secure
Ivanti heeft meerdere kwetsbaarheden verholpen in Connect Secure.
first Oct 13, 2026 -
Medium max 7.0
Ivanti Connect Secure: Schwachstelle ermöglicht Privilegieneskalation
Ein lokaler Angreifer kann eine Schwachstelle in Ivanti Connect Secure ausnutzen, um seine Privilegien zu erhöhen.
-
High max 8.9NCSC-2025-0292 11 CVEs
Kwetsbaarheden verholpen in Ivanti producten
Ivanti heeft kwetsbaarheden verholpen in meerdere producten zoals Connect Secure en Policy Secure.
-
High max 8.9WID-SEC-2025-2010 11 CVEs
Ivanti Connect Secure und Policy Secure: Mehrere Schwachstellen
Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen in Ivanti Connect Secure und Ivanti Policy Secure ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, einen Denial-of-Service-Zustand zu verursachen, vertraulic…
65 results · Feed
-
Medium 4.3CVE-2026-118527 Exploited
Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticat…
KEV Oct 30, 2026 -
High 7.0CVE-2026-111357 Exploited
Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, l…
KEV Oct 30, 2026 -
High 8.6
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute ar…
KEV Oct 13, 2026 -
Medium 5.4
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti …
-
Medium 6.1
Reflected text injection in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivan…
-
High 8.8
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti …
-
High 8.8
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti …
-
Medium 6.8
SSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway befor…
-
High 7.6
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti …
-
High 8.8
CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway befor…
-
Medium 4.9
An unchecked return value in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Iva…
-
Medium 5.4
CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway befor…
-
Medium 5.5
Improper handling of symbolic links in Ivanti Connect Secure before version 22.7R2.8 or 22.8R2, Ivanti Policy Secure be…
-
Medium 4.9
XEE in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before…
-
High 7.5
A heap-based buffer overflow in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, …
-
High 7.5
A buffer over-read vulnerability in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1…
-
Medium 5.5
SSRF in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote …
-
Medium 6.6
CLRF injection in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows…
-
Medium 6.5
Insertion of sensitive information into a log file in Ivanti Connect Secure before version 22.7R2.8 allows a local auth…
-
Medium 5.5
Insertion of sensitive information into a log file in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy S…
-
Medium 4.9
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version …
-
Medium 6.3
Improper access control in the certificate management component of Ivanti Connect Secure before version 22.7R2.8 and Iv…
-
Critical 9.0
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.…
KEV Apr 4, 2025 -
Critical 9.1
External control of a file name in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before versio…
-
Medium 6.0
Cleartext storage of information in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before versi…
-
Medium 6.0
A hardcoded key in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.3 allow…
-
Medium 6.1
Reflected XSS in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows …
-
Medium 6.8
External control of a file name in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before versio…
-
Critical 9.1
Code injection in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows…
-
Critical 9.9
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6 allows a remote authenticated attacker t…
-
High 7.0CVE-2025-0283 EPSS 17%
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.…
-
Critical 9.0
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.…
KEV Jan 8, 2025 -
High 7.5
An out-of-bounds read in IPsec of Ivanti Connect Secure before version 22.7R2.1 allows a remote unauthenticated attacke…
-
High 7.5
A heap-based buffer overflow in IPsec of Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated …
-
Critical 9.1
Command injection in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 all…
-
Critical 9.1
Argument injection in Ivanti Connect Secure before version 22.7R2.4 allows a remote authenticated attacker with admin p…
-
High 7.1
Insufficient server-side controls in Secure Application Manager of Ivanti Connect Secure before version 22.7R2.4 allows…
-
High 7.8
Incorrect file permissions in Ivanti Connect Secure before version 22.6R2 (Not Applicable to 9.1Rx) and Ivanti Policy S…
-
Critical 9.1
Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before versio…
-
Critical 9.1
Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before versio…